From 0a74509d00f8848a46b2d89c61cfe710d5cbfc2a Mon Sep 17 00:00:00 2001
From: Luke McCrone <lrm110484@gmail.com>
Date: Mon, 8 Apr 2024 18:41:38 -0300
Subject: [PATCH] test: initial users tests (admin, userplus, user)

---
 .github/workflows/system.yml |   2 +-
 tests/.env.default           |   3 +-
 tests/run.sh                 |  14 ++-
 tests/run_all.sh             |  11 +--
 tests/test_aws.sh            |   1 +
 tests/test_aws_posix.sh      |   1 +
 tests/test_common.sh         |  13 +--
 tests/test_mc.sh             |   1 +
 tests/test_s3cmd.sh          |   1 +
 tests/test_user.sh           | 162 +++++++++++++++++++++++++++++++++++
 tests/util.sh                |  87 ++++++++-----------
 tests/util_bucket_create.sh  |  79 +++++++++++++++++
 tests/util_users.sh          |  85 ++++++++++++++++++
 tests/versity.sh             |   7 +-
 14 files changed, 393 insertions(+), 74 deletions(-)
 create mode 100755 tests/test_user.sh
 create mode 100644 tests/util_bucket_create.sh
 create mode 100644 tests/util_users.sh

diff --git a/.github/workflows/system.yml b/.github/workflows/system.yml
index 802c7ef4..d82560aa 100644
--- a/.github/workflows/system.yml
+++ b/.github/workflows/system.yml
@@ -51,7 +51,7 @@ jobs:
           export WORKSPACE=$GITHUB_WORKSPACE
           openssl genpkey -algorithm RSA -out versitygw.pem -pkeyopt rsa_keygen_bits:2048
           openssl req -new -x509 -key versitygw.pem -out cert.pem -days 365 -subj "/C=US/ST=California/L=San Francisco/O=Versity/OU=Software/CN=versity.com"
-          mkdir cover
+          mkdir cover iam
           VERSITYGW_TEST_ENV=./tests/.env.default ./tests/run_all.sh
 
       #- name: Build and run, s3 backend
diff --git a/tests/.env.default b/tests/.env.default
index 1a736c83..eb62d873 100644
--- a/tests/.env.default
+++ b/tests/.env.default
@@ -13,4 +13,5 @@ S3CMD_CONFIG=./tests/s3cfg.local.default
 SECRETS_FILE=./tests/.secrets
 MC_ALIAS=versity
 LOG_LEVEL=2
-GOCOVERDIR=$PWD/cover
\ No newline at end of file
+GOCOVERDIR=$PWD/cover
+USERS_FOLDER=$PWD/iam
\ No newline at end of file
diff --git a/tests/run.sh b/tests/run.sh
index 68a213d3..cda7d7c5 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -20,7 +20,7 @@ handle_param() {
       -s|--static)
           export RECREATE_BUCKETS=false
           ;;
-      aws|aws-posix|s3cmd|mc)
+      aws|aws-posix|s3cmd|mc|user)
           set_command_type "$1"
           ;;
       *) # Handle unrecognized options or positional arguments
@@ -39,7 +39,14 @@ set_command_type() {
   export command_type
 }
 
-export RECREATE_BUCKETS=true
+if [[ -z $RECREATE_BUCKETS ]]; then
+  export RECREATE_BUCKETS=true
+elif [[ $RECREATE_BUCKETS != true ]] && [[ $RECREATE_BUCKETS != false ]]; then
+  echo "Invalid RECREATE_BUCKETS value: $RECREATE_BUCKETS"
+  exit 1
+else
+  export RECREATE_BUCKETS=$RECREATE_BUCKETS
+fi
 while [[ "$#" -gt 0 ]]; do
   handle_param "$1"
   shift # past argument or value
@@ -70,6 +77,9 @@ case $command_type in
   mc)
     "$HOME"/bin/bats ./tests/test_mc.sh || exit_code=$?
     ;;
+  user)
+    "$HOME"/bin/bats ./tests/test_user.sh || exit_code=$?
+    ;;
 esac
 
 exit $exit_code
diff --git a/tests/run_all.sh b/tests/run_all.sh
index 61a9bbc2..873fb0a0 100755
--- a/tests/run_all.sh
+++ b/tests/run_all.sh
@@ -16,16 +16,7 @@ fi
 if ! ./tests/run.sh mc; then
   exit 1
 fi
-if ! ./tests/run.sh -s aws; then
-  exit 1
-fi
-if ! ./tests/run.sh -s aws-posix; then
-  exit 1
-fi
-if ! ./tests/run.sh -s s3cmd; then
-  exit 1
-fi
-if ! ./tests/run.sh -s mc; then
+if ! ./tests/run.sh user; then
   exit 1
 fi
 exit 0
diff --git a/tests/test_aws.sh b/tests/test_aws.sh
index 1f9e0227..9a1203d3 100755
--- a/tests/test_aws.sh
+++ b/tests/test_aws.sh
@@ -2,6 +2,7 @@
 
 source ./tests/setup.sh
 source ./tests/util.sh
+source ./tests/util_bucket_create.sh
 source ./tests/util_file.sh
 source ./tests/test_common.sh
 
diff --git a/tests/test_aws_posix.sh b/tests/test_aws_posix.sh
index 375d1bfe..c787734c 100755
--- a/tests/test_aws_posix.sh
+++ b/tests/test_aws_posix.sh
@@ -2,6 +2,7 @@
 
 source ./tests/setup.sh
 source ./tests/util.sh
+source ./tests/util_bucket_create.sh
 source ./tests/util_file.sh
 source ./tests/util_posix.sh
 
diff --git a/tests/test_common.sh b/tests/test_common.sh
index fc400901..0a470ee0 100644
--- a/tests/test_common.sh
+++ b/tests/test_common.sh
@@ -163,7 +163,7 @@ test_common_set_get_bucket_tags() {
 
   if [[ $1 == 'aws' ]]; then
     if [[ $tags != "" ]]; then
-      tag_set=$(echo "$tags" | sed '1d' | jq '.TagSet')
+      tag_set=$(echo "$tags" | jq '.TagSet')
       [[ $tag_set == "[]" ]] || fail "Error:  tags not empty: $tags"
     fi
   else
@@ -177,8 +177,9 @@ test_common_set_get_bucket_tags() {
   local tag_set_key
   local tag_set_value
   if [[ $1 == 'aws' ]]; then
-    tag_set_key=$(echo "$tags" | sed '1d' | jq '.TagSet[0].Key')
-    tag_set_value=$(echo "$tags" | sed '1d' | jq '.TagSet[0].Value')
+    log 5 "Post-export tags: $tags"
+    tag_set_key=$(echo "$tags" | jq '.TagSet[0].Key')
+    tag_set_value=$(echo "$tags" | jq '.TagSet[0].Value')
     [[ $tag_set_key == '"'$key'"' ]] || fail "Key mismatch"
     [[ $tag_set_value == '"'$value'"' ]] || fail "Value mismatch"
   else
@@ -211,7 +212,7 @@ test_common_set_get_object_tags() {
   get_object_tags "$1" "$BUCKET_ONE_NAME" $bucket_file || local get_result=$?
   [[ $get_result -eq 0 ]] || fail "Error getting object tags"
   if [[ $1 == 'aws' ]]; then
-    tag_set=$(echo "$tags" | sed '1d' | jq '.TagSet')
+    tag_set=$(echo "$tags" | jq '.TagSet')
     [[ $tag_set == "[]" ]] || fail "Error:  tags not empty"
   elif [[ ! $tags == *"No tags found"* ]]; then
     fail "no tags found (tags: $tags)"
@@ -221,8 +222,8 @@ test_common_set_get_object_tags() {
   get_object_tags "$1" "$BUCKET_ONE_NAME" $bucket_file || local get_result_two=$?
   [[ $get_result_two -eq 0 ]] || fail "Error getting object tags"
   if [[ $1 == 'aws' ]]; then
-    tag_set_key=$(echo "$tags" | sed '1d' | jq '.TagSet[0].Key')
-    tag_set_value=$(echo "$tags" | sed '1d' | jq '.TagSet[0].Value')
+    tag_set_key=$(echo "$tags" | jq '.TagSet[0].Key')
+    tag_set_value=$(echo "$tags" | jq '.TagSet[0].Value')
     [[ $tag_set_key == '"'$key'"' ]] || fail "Key mismatch"
     [[ $tag_set_value == '"'$value'"' ]] || fail "Value mismatch"
   else
diff --git a/tests/test_mc.sh b/tests/test_mc.sh
index 26889129..060a9716 100755
--- a/tests/test_mc.sh
+++ b/tests/test_mc.sh
@@ -2,6 +2,7 @@
 
 source ./tests/test_common.sh
 source ./tests/setup.sh
+source ./tests/util_bucket_create.sh
 
 export RUN_MC=true
 
diff --git a/tests/test_s3cmd.sh b/tests/test_s3cmd.sh
index 74cf5ee7..49957786 100755
--- a/tests/test_s3cmd.sh
+++ b/tests/test_s3cmd.sh
@@ -3,6 +3,7 @@
 source ./tests/setup.sh
 source ./tests/test_common.sh
 source ./tests/util.sh
+source ./tests/util_bucket_create.sh
 
 export RUN_S3CMD=true
 
diff --git a/tests/test_user.sh b/tests/test_user.sh
new file mode 100755
index 00000000..a76eb51b
--- /dev/null
+++ b/tests/test_user.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bats
+
+source ./tests/setup.sh
+source ./tests/util_users.sh
+source ./tests/util.sh
+source ./tests/util_bucket_create.sh
+
+@test "test_admin_user" {
+  admin_username="ABCDEF"
+  user_username="GHIJKL"
+  admin_password="123456"
+  user_password="789012"
+
+  user_exists "$admin_username" || local admin_exists_result=$?
+  if [[ $admin_exists_result -eq 0 ]]; then
+    delete_user "$admin_username" || local delete_admin_result=$?
+    [[ $delete_admin_result -eq 0 ]] || fail "failed to delete admin user"
+  fi
+  create_user "$admin_username" "$admin_password" "admin" || create_admin_result=$?
+  [[ $create_admin_result -eq 0 ]] || fail "failed to create admin user"
+
+  user_exists "$user_username" || local user_exists_result=$?
+  if [[ $user_exists_result -eq 0 ]]; then
+    delete_user "$user_username" || local delete_user_result=$?
+    [[ $delete_user_result -eq 0 ]] || fail "failed to delete user user"
+  fi
+  create_user_with_user "$admin_username" "$admin_password" "$user_username" "$user_password" "user"
+
+  setup_bucket "aws" "$BUCKET_ONE_NAME" || local setup_result=$?
+  [[ $setup_result -eq 0 ]] || fail "error setting up bucket"
+  delete_bucket "aws" "versity-gwtest-admin-bucket" || local delete_result=$?
+  [[ $delete_result -eq 0 ]] || fail "error deleting bucket if it exists"
+  create_bucket_with_user "aws" "versity-gwtest-admin-bucket" "$admin_username" "$admin_password" || create_result_two=$?
+  [[ $create_result_two -eq 0 ]] || fail "error creating bucket with user"
+
+  bucket_one_found=false
+  bucket_two_found=false
+  list_buckets_with_user "aws" "$admin_username" "$admin_password"
+  for bucket in "${bucket_array[@]}"; do
+    if [ "$bucket" == "$BUCKET_ONE_NAME" ]; then
+      bucket_one_found=true
+    elif [ "$bucket" == "versity-gwtest-admin-bucket" ]; then
+      bucket_two_found=true
+    fi
+    if [ $bucket_one_found == true ] && [ $bucket_two_found == true ]; then
+      break
+    fi
+  done
+  if [ $bucket_one_found == false ] || [ $bucket_two_found == false ]; then
+    fail "not all expected buckets listed"
+  fi
+  change_bucket_owner "$admin_username" "$admin_password" "versity-gwtest-admin-bucket" "$user_username" || local change_result=$?
+  [[ $change_result -eq 0 ]] || fail "error changing bucket owner"
+
+  delete_bucket "aws" "versity-gwtest-admin-bucket"
+  delete_user "$user_username"
+  delete_user "$admin_username"
+}
+
+@test "test_create_user_already_exists" {
+  username="ABCDEG"
+  password="123456"
+
+  user_exists "$username" || local exists_result=$?
+  if [[ $exists_result -eq 0 ]]; then
+    delete_user "$username" || local delete_result=$?
+    [[ $delete_result -eq 0 ]] || fail "failed to delete user '$username'"
+  fi
+
+  create_user "$username" "123456" "admin" || local create_result=$?
+  [[ $create_result -eq 0 ]] || fail "error creating user"
+  create_user "$username" "123456" "admin" || local create_result=$?
+  [[ $create_result -eq 1 ]] || fail "'user already exists' error not returned"
+
+  delete_bucket "aws" "versity-gwtest-admin-bucket"
+  delete_user "$username"
+}
+
+@test "test_user_user" {
+  username="ABCDEG"
+  password="123456"
+
+  user_exists "$username" || local exists_result=$?
+  if [[ $exists_result -eq 0 ]]; then
+    delete_user "$username" || local delete_result=$?
+    [[ $delete_result -eq 0 ]] || fail "failed to delete user '$username'"
+  fi
+  delete_bucket "aws" "versity-gwtest-user-bucket"
+
+  create_user "$username" "123456" "user" || local create_result=$?
+  [[ $create_result -eq 0 ]] || fail "error creating user"
+  setup_bucket "aws" "$BUCKET_ONE_NAME" || local setup_result=$?
+  [[ $setup_result -eq 0 ]] || fail "error setting up bucket"
+
+  create_bucket_with_user "aws" "versity-gwtest-user-bucket" "$username" "$password" || create_result_two=$?
+  [[ $create_result_two -eq 1 ]] || fail "creating bucket with 'user' account failed to return error"
+  [[ $error == *"Access Denied"* ]] || fail "error message '$error' doesn't contain 'Access Denied'"
+
+  create_bucket "aws" "versity-gwtest-user-bucket" || create_result_three=$?
+  [[ $create_result_three -eq 0 ]] || fail "creating bucket account returned error"
+
+  change_bucket_owner "$AWS_ACCESS_KEY_ID" "$AWS_SECRET_ACCESS_KEY" "versity-gwtest-user-bucket" "$username" || local change_result=$?
+  [[ $change_result -eq 0 ]] || fail "error changing bucket owner"
+  change_bucket_owner "$username" "$password" "versity-gwtest-user-bucket" "admin" || local change_result_two=$?
+  [[ $change_result_two -eq 1 ]] || fail "user shouldn't be able to change bucket owner"
+
+  list_buckets_with_user "aws" "$username" "$password"
+  bucket_found=false
+  for bucket in "${bucket_array[@]}"; do
+    if [ "$bucket" == "$BUCKET_ONE_NAME" ]; then
+      fail "$BUCKET_ONE_NAME shouldn't show up in 'user' bucket list"
+    elif [ "$bucket" == "versity-gwtest-user-bucket" ]; then
+      bucket_found=true
+    fi
+  done
+  if [ $bucket_found == false ]; then
+    fail "user-owned bucket not found in user list"
+  fi
+
+  delete_bucket "aws" "versity-gwtest-user-bucket"
+  delete_user "$username"
+}
+
+@test "test_userplus_operation" {
+  username="ABCDEG"
+  password="123456"
+
+  user_exists "$username" || local exists_result=$?
+  if [[ $exists_result -eq 0 ]]; then
+    delete_user "$username" || local delete_result=$?
+    [[ $delete_result -eq 0 ]] || fail "failed to delete user '$username'"
+  fi
+  delete_bucket "aws" "versity-gwtest-userplus-bucket"
+
+  create_user "$username" "123456" "userplus" || local create_result=$?
+  [[ $create_result -eq 0 ]] || fail "error creating user"
+  setup_bucket "aws" "$BUCKET_ONE_NAME" || local setup_result=$?
+  [[ $setup_result -eq 0 ]] || fail "error setting up bucket"
+
+  create_bucket_with_user "aws" "versity-gwtest-userplus-bucket" "$username" "$password" || create_result_two=$?
+  [[ $create_result_two -eq 0 ]] || fail "error creating bucket"
+
+  list_buckets_with_user "aws" "$username" "$password"
+  bucket_found=false
+  for bucket in "${bucket_array[@]}"; do
+    if [ "$bucket" == "$BUCKET_ONE_NAME" ]; then
+      fail "$BUCKET_ONE_NAME shouldn't show up in 'userplus' bucket list"
+    elif [ "$bucket" == "versity-gwtest-userplus-bucket" ]; then
+      bucket_found=true
+    fi
+  done
+  if [ $bucket_found == false ]; then
+    fail "userplus-owned bucket not found in user list"
+  fi
+
+  change_bucket_owner "$username" "$password" "versity-gwtest-userplus-bucket" "admin" || local change_result_two=$?
+  [[ $change_result_two -eq 1 ]] || fail "userplus shouldn't be able to change bucket owner"
+
+  delete_bucket "aws" "versity-gwtest-admin-bucket"
+  delete_user "$username" || delete_result=$?
+  [[ $delete_result -eq 0 ]] || fail "error deleting user"
+}
diff --git a/tests/util.sh b/tests/util.sh
index 5e0037e0..a6c8ac8d 100644
--- a/tests/util.sh
+++ b/tests/util.sh
@@ -1,59 +1,8 @@
-#!/usr/bin/env bats
+#!/usr/bin/env bash
 
 source ./tests/util_mc.sh
 source ./tests/logger.sh
 
-# create an AWS bucket
-# param:  bucket name
-# return 0 for success, 1 for failure
-create_bucket() {
-  if [ $# -ne 2 ]; then
-    echo "create bucket missing command type, bucket name"
-    return 1
-  fi
-
-  local exit_code=0
-  local error
-  if [[ $1 == "aws" ]]; then
-    error=$(aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "s3cmd" ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "mc" ]]; then
-    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    echo "error creating bucket: $error"
-    return 1
-  fi
-  return 0
-}
-
-create_bucket_invalid_name() {
-  if [ $# -ne 1 ]; then
-    echo "create bucket w/invalid name missing command type"
-    return 1
-  fi
-  local exit_code=0
-  if [[ $1 == "aws" ]]; then
-    bucket_create_error=$(aws --no-verify-ssl s3 mb "s3://" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    bucket_create_error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb "s3://" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    bucket_create_error=$(mc --insecure mb "$MC_ALIAS" 2>&1) || exit_code=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -eq 0 ]; then
-    echo "error:  bucket should have not been created but was"
-    return 1
-  fi
-  export bucket_create_error
-}
-
 # delete an AWS bucket
 # param:  bucket name
 # return 0 for success, 1 for failure
@@ -298,6 +247,7 @@ put_object() {
     echo "invalid command type $1"
     return 1
   fi
+  log 5 "put object exit code: $exit_code"
   if [ $exit_code -ne 0 ]; then
     echo "error copying object to bucket: $error"
     return 1
@@ -420,6 +370,35 @@ list_buckets() {
   export bucket_array
 }
 
+list_buckets_with_user() {
+  if [[ $# -ne 3 ]]; then
+    echo "List buckets command missing format, user id, key"
+    return 1
+  fi
+
+  local exit_code=0
+  local output
+  if [[ $1 == "aws" ]]; then
+    output=$(AWS_ACCESS_KEY_ID="$2" AWS_SECRET_ACCESS_KEY="$3" aws --no-verify-ssl s3 ls s3:// 2>&1) || exit_code=$?
+  else
+    echo "invalid format:  $1"
+    return 1
+  fi
+
+  if [ $exit_code -ne 0 ]; then
+    echo "error listing buckets: $output"
+    return 1
+  fi
+
+  bucket_array=()
+  while IFS= read -r line; do
+    bucket_name=$(echo "$line" | awk '{print $NF}')
+    bucket_array+=("${bucket_name%/}")
+  done <<< "$output"
+
+  export bucket_array
+}
+
 # list objects on versitygw, in bucket or folder
 # param:  path of bucket or folder
 # export object_array (object names) on success, return 1 for failure
@@ -574,6 +553,8 @@ get_bucket_tags() {
     echo "invalid command type $1"
     return 1
   fi
+  log 5 "Tags: $tags"
+  tags=$(echo "$tags" | grep -v "InsecureRequestWarning")
   if [[ $result -ne 0 ]]; then
     if [[ $tags =~ "No tags found" ]] || [[ $tags =~ "The TagSet does not exist" ]]; then
       export tags=
@@ -648,6 +629,8 @@ get_object_tags() {
     echo "error getting object tags: $tags"
     return 1
   fi
+  log 5 "$tags"
+  tags=$(echo "$tags" | grep -v "InsecureRequestWarning")
   export tags
 }
 
diff --git a/tests/util_bucket_create.sh b/tests/util_bucket_create.sh
new file mode 100644
index 00000000..ea0fdf20
--- /dev/null
+++ b/tests/util_bucket_create.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+source ./tests/util_mc.sh
+source ./tests/logger.sh
+
+# create an AWS bucket
+# param:  bucket name
+# return 0 for success, 1 for failure
+create_bucket() {
+  if [ $# -ne 2 ]; then
+    echo "create bucket missing command type, bucket name"
+    return 1
+  fi
+
+  local exit_code=0
+  local error
+  if [[ $1 == "aws" ]]; then
+    error=$(aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "s3cmd" ]]; then
+    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "mc" ]]; then
+    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
+  else
+    echo "invalid command type $1"
+    return 1
+  fi
+  if [ $exit_code -ne 0 ]; then
+    echo "error creating bucket: $error"
+    return 1
+  fi
+  return 0
+}
+
+create_bucket_with_user() {
+  if [ $# -ne 4 ]; then
+    echo "create bucket missing command type, bucket name, access, secret"
+    return 1
+  fi
+  local exit_code=0
+  if [[ $1 == "aws" ]]; then
+    error=$(AWS_ACCESS_KEY_ID="$3" AWS_SECRET_ACCESS_KEY="$4" aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "s3cmd" ]]; then
+    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "mc" ]]; then
+    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
+  else
+    echo "invalid command type $1"
+    return 1
+  fi
+  if [ $exit_code -ne 0 ]; then
+    echo "error creating bucket: $error"
+    export error
+    return 1
+  fi
+  return 0
+}
+
+create_bucket_invalid_name() {
+  if [ $# -ne 1 ]; then
+    echo "create bucket w/invalid name missing command type"
+    return 1
+  fi
+  local exit_code=0
+  if [[ $1 == "aws" ]]; then
+    bucket_create_error=$(aws --no-verify-ssl s3 mb "s3://" 2>&1) || exit_code=$?
+  elif [[ $1 == 's3cmd' ]]; then
+    bucket_create_error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb "s3://" 2>&1) || exit_code=$?
+  elif [[ $1 == 'mc' ]]; then
+    bucket_create_error=$(mc --insecure mb "$MC_ALIAS" 2>&1) || exit_code=$?
+  else
+    echo "invalid command type $1"
+    return 1
+  fi
+  if [ $exit_code -eq 0 ]; then
+    echo "error:  bucket should have not been created but was"
+    return 1
+  fi
+  export bucket_create_error
+}
diff --git a/tests/util_users.sh b/tests/util_users.sh
new file mode 100644
index 00000000..ff1edbe8
--- /dev/null
+++ b/tests/util_users.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+create_user() {
+  if [[ $# -ne 3 ]]; then
+    echo "create user command requires user ID, key, and role"
+    return 1
+  fi
+  create_user_with_user "$AWS_ACCESS_KEY_ID" "$AWS_SECRET_ACCESS_KEY" "$1" "$2" "$3" || create_result=$?
+  if [[ $create_result -ne 0 ]]; then
+    echo "error creating user: $error"
+    return 1
+  fi
+  return 0
+}
+
+create_user_with_user() {
+  if [[ $# -ne 5 ]]; then
+    echo "create user with user command requires creator ID, key, and new user ID, key, and role"
+    return 1
+  fi
+  error=$($VERSITY_EXE admin --allow-insecure --access "$1" --secret "$2" --endpoint-url "$AWS_ENDPOINT_URL" create-user --access "$3" --secret "$4" --role "$5") || local create_result=$?
+  if [[ $create_result -ne 0 ]]; then
+    echo "error creating user: $error"
+    return 1
+  fi
+  return 0
+}
+
+list_users() {
+  users=$($VERSITY_EXE admin --allow-insecure --access "$AWS_ACCESS_KEY_ID" --secret "$AWS_SECRET_ACCESS_KEY" --endpoint-url "$AWS_ENDPOINT_URL" list-users) || local list_result=$?
+  if [[ $list_result -ne 0 ]]; then
+    echo "error listing users: $users"
+    return 1
+  fi
+  parsed_users=()
+  while IFS= read -r line; do
+    parsed_users+=("$line")
+  done < <(awk 'NR>2 {print $1}' <<< "$users")
+  export parsed_users
+  return 0
+}
+
+user_exists() {
+  if [[ $# -ne 1 ]]; then
+    echo "user exists command requires username"
+    return 2
+  fi
+  list_users || local list_result=$?
+  if [[ $list_result -ne 0 ]]; then
+    echo "error listing user"
+    return 2
+  fi
+  for element in "${parsed_users[@]}"; do
+    if [[ $element == "$1" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+delete_user() {
+  if [[ $# -ne 1 ]]; then
+      echo "delete user command requires user ID"
+      return 1
+    fi
+    error=$($VERSITY_EXE admin --allow-insecure --access $AWS_ACCESS_KEY_ID --secret $AWS_SECRET_ACCESS_KEY --endpoint-url $AWS_ENDPOINT_URL delete-user --access "$1") || local delete_result=$?
+    if [[ $delete_result -ne 0 ]]; then
+      echo "error deleting user: $error"
+      return 1
+    fi
+    return 0
+}
+
+change_bucket_owner() {
+  if [[ $# -ne 4 ]]; then
+      echo "change bucket owner command requires ID, key, bucket name, and new owner"
+      return 1
+    fi
+    error=$($VERSITY_EXE admin --allow-insecure --access "$1" --secret "$2" --endpoint-url "$AWS_ENDPOINT_URL" change-bucket-owner --bucket "$3" --owner "$4" 2>&1) || local change_result=$?
+    if [[ $change_result -ne 0 ]]; then
+      echo "error changing bucket owner: $error"
+      return 1
+    fi
+    return 0
+}
diff --git a/tests/versity.sh b/tests/versity.sh
index fde0d5f9..d8b1ced0 100644
--- a/tests/versity.sh
+++ b/tests/versity.sh
@@ -44,6 +44,9 @@ check_exe_params() {
   elif [[ $RUN_VERSITYGW != "true" ]] && [[ $RUN_VERSITYGW != "false" ]]; then
     echo "RUN_VERSITYGW must be 'true' or 'false'"
     return 1
+  elif [ -z "$USERS_FOLDER" ]; then
+    echo "No users folder parameter set"
+    return 1
   fi
   if [[ -r $GOCOVERDIR ]]; then
     export GOCOVERDIR=$GOCOVERDIR
@@ -89,7 +92,7 @@ start_versity() {
     fi
   fi
 
-  export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_REGION AWS_PROFILE AWS_ENDPOINT_URL
+  export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_REGION AWS_PROFILE AWS_ENDPOINT_URL VERSITY_EXE
 }
 
 start_versity_process() {
@@ -128,7 +131,7 @@ run_versity_app_posix() {
     echo "run versity app w/posix command requires access ID, secret key, process number"
     return 1
   fi
-  base_command=("$VERSITY_EXE" --access="$1" --secret="$2" --region="$AWS_REGION")
+  base_command=("$VERSITY_EXE" --access="$1" --secret="$2" --region="$AWS_REGION"  --iam-dir="$USERS_FOLDER")
   if [ -n "$CERT" ] && [ -n "$KEY" ]; then
     base_command+=(--cert "$CERT" --key "$KEY")
   fi